Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 01-14-2006, 12:16
The Day Walker!
 
Posts: n/a
crc32 help needed?

pals... patching an ocx control...

but found that it has a crc32 check, if i change a single bit of code,

the entire control stops working....

control:- aresize.ocx (vbgold.com)

peid shows:- 1.jpg

in w32dasm at that location:- 2.jpg

and when, i saw the last bytes of the file in hex i found this:- 3.jpg

what does these last bytes indicate... r they the crc32 for the file??

m new 2 crc32,,,, needed help in patching it...

thanx

TDW {RES}
Attached Images
File Type: jpg 1.JPG (3.5 KB, 26 views)
File Type: jpg 2.JPG (57.1 KB, 22 views)
File Type: jpg 3.JPG (91.9 KB, 18 views)
Reply With Quote
  #2  
Old 01-14-2006, 17:11
MaRKuS-DJM's Avatar
MaRKuS-DJM MaRKuS-DJM is offline
Cracker + Unpacker
 
Join Date: Aug 2003
Location: Virtual World / Network
Posts: 553
Rept. Given: 7
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 3
Thanks Rcvd at 16 Times in 10 Posts
MaRKuS-DJM Reputation: 6
load your target app that uses the ocx into your debugger and try to break on CreateFileA. normally you should be near the CRC-check then. and also watch stack if it is the correct file.
Reply With Quote
  #3  
Old 01-14-2006, 18:39
adaptor adaptor is offline
Friend
 
Join Date: Jan 2006
Posts: 27
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
adaptor Reputation: 0
In case of 'in-memory-check' :
1) Patch one needed byte of code and put memory breakpoint on it.
2) Let programm continue and watch where it breaks, probably it will be near CRC check.
Reply With Quote
  #4  
Old 01-15-2006, 06:15
Unforgiv3N's Avatar
Unforgiv3N Unforgiv3N is offline
Friend
 
Join Date: Aug 2005
Posts: 172
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 3 Times in 3 Posts
Unforgiv3N Reputation: 0
1.Open PEiD+KryptoAnalyzer Plugins (i know that should use "C" in "K"rypto but that's name of it, that's that! )
2.Drag your .ocx file into it. (because PEiD Never Shell .ocx files)
3.in Plugins Section, Select theKryptoAnalyzerPlugins then it will show you the CRC32 and depending on your target you can replace it with NOPs. in same cases it worked.

I wrote it for new friends want to know how you did detect CRC32 on this OCX

Last edited by Unforgiv3N; 01-15-2006 at 06:18.
Reply With Quote
  #5  
Old 01-15-2006, 12:52
The Day Walker!
 
Posts: n/a
@ Unforgiv3N

krypto analyser showed me that the ocx has crc32.... checkout the images

that i have attached above,,,,, everything is specified.....

and for the nopping thing.. ill give it a try...

thanx

TDW {RES}
Reply With Quote
  #6  
Old 01-16-2006, 14:53
hjwyq
 
Posts: n/a
sorry

It cann't run in my mathine!

when loader,my system halted!why?
win2k sp4

but i think when you can step in,or you can got rid of CRC.
GOOD LUCK
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
HELP, CRC32 Mitchjs General Discussion 8 07-04-2004 01:20
a newbie question about CRC32 abccc General Discussion 13 04-23-2004 03:13


All times are GMT +8. The time now is 04:09.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )